## Abstract

We consider randomized encodings (RE) that enable encoding a Turing machine Π and input x into its “randomized encoding” Π(x) in sublinear, or even polylogarithmic, time in the running-time of Π(x), independent of its output length. We refer to the former as sublinear RE and the latter as compact RE. For such efficient RE, the standard simulation-based notion of security is impossible, and we thus consider a weaker (distributional) indistinguishability-based notion of security: Roughly speaking, we require indistinguishability of Π_{0}(x_{0}) and Π_{0}(x_{1}) as long as Π_{0},x_{0} and Π_{1},x_{1} are sampled from some distributions such that Π_{0}(x_{0}),Time(Π_{0}(x_{0})) and Π_{1}(x_{1}),Time(Π_{1}(x_{1})) are indistinguishable. We show the following: Impossibility in the Plain Model: Assuming the existence of subexponentially secure one-way functions, subexponentially-secure sublinear RE does not exists. (If additionally assuming subexponentially-secure iO for circuits we can also rule out polynomially-secure sublinear RE.) As a consequence, we rule out also puncturable iO for Turing machines (even those without inputs). Feasibility in the CRS model and Applications to iO for circuits: Subexponentially-secure sublinear RE in the CRS model and one-way functions imply iO for circuits through a simple construction generalizing GGM’s PRF construction. Additionally, any compact (even with sublinear compactness) functional encryption essentially directly yields a sublinear RE in the CRS model, and as such we get an alternative, modular, and simpler proof of the results of [AJ15, BV15] showing that subexponentially-secure sublinearly compact FE implies iO. We further show other ways of instantiating sublinear RE in the CRS model (and thus also iO): under the subexponential LWE assumption, it suffices to have a subexponentially secure FE schemes with just sublinear ciphertext (as opposed to having sublinear encryption time). Applications to iO for Unbounded-input Turing machines: Subexponentially-secure compact RE for natural restricted classes of distributions over programs and inputs (which are not ruled out by our impossibility result, and for which we can give candidate constructions) imply iO for unbounded-input Turing machines. This yields the first construction of iO for unbounded-input Turing machines that does not rely on (public-coin) differing-input obfuscation.

Original language | English |
---|---|

Title of host publication | Theory of Cryptography - 13th International Conference, TCC 2016-A, Proceedings |

Editors | Eyal Kushilevitz, Tal Malkin |

Publisher | Springer Verlag |

Pages | 96-124 |

Number of pages | 29 |

ISBN (Print) | 9783662490952 |

DOIs | |

State | Published - 2016 |

Externally published | Yes |

Event | 13th International Conference on Theory of Cryptography, TCC 2016 - Tel Aviv, Israel Duration: 10 Jan 2016 → 13 Jan 2016 |

### Publication series

Name | Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) |
---|---|

Volume | 9562 |

ISSN (Print) | 0302-9743 |

ISSN (Electronic) | 1611-3349 |

### Conference

Conference | 13th International Conference on Theory of Cryptography, TCC 2016 |
---|---|

Country/Territory | Israel |

City | Tel Aviv |

Period | 10/01/16 → 13/01/16 |